Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
16-01-2023 23:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
General
-
Target
file.exe
-
Size
534KB
-
MD5
4715769b2a3a90dc8c939aec11c52bc1
-
SHA1
1a1eeabc9d4758de67016ed1e06defd571107e63
-
SHA256
7ce366cf2cc3e1787d552e5603568e1ce96496aacef73df9676b9a3fafe660db
-
SHA512
308badf1be750b58399a3532b452a85cf345d222a1ec48949c99fd5cbe6505a79e8093b72ea117ef8b3963b8ddcbf2812907a5d8535b98c9480bb038fcdfe579
-
SSDEEP
12288:j3RH/6XLdYJkrsi+u3bYIvz6D6bX1lbBLfzn6lU1F4Xla:DY5YgEmFpBr9yM
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" file.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2016 set thread context of 1080 2016 file.exe 39 -
Program crash 1 IoCs
pid pid_target Process procid_target 820 1080 WerFault.exe 39 -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe 2016 file.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2016 file.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2016 file.exe Token: SeLoadDriverPrivilege 2016 file.exe Token: SeDebugPrivilege 2016 file.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1992 2016 file.exe 27 PID 2016 wrote to memory of 1992 2016 file.exe 27 PID 2016 wrote to memory of 1992 2016 file.exe 27 PID 2016 wrote to memory of 1160 2016 file.exe 28 PID 2016 wrote to memory of 1160 2016 file.exe 28 PID 2016 wrote to memory of 1160 2016 file.exe 28 PID 2016 wrote to memory of 544 2016 file.exe 29 PID 2016 wrote to memory of 544 2016 file.exe 29 PID 2016 wrote to memory of 544 2016 file.exe 29 PID 2016 wrote to memory of 544 2016 file.exe 29 PID 2016 wrote to memory of 584 2016 file.exe 30 PID 2016 wrote to memory of 584 2016 file.exe 30 PID 2016 wrote to memory of 584 2016 file.exe 30 PID 2016 wrote to memory of 676 2016 file.exe 31 PID 2016 wrote to memory of 676 2016 file.exe 31 PID 2016 wrote to memory of 676 2016 file.exe 31 PID 2016 wrote to memory of 1884 2016 file.exe 32 PID 2016 wrote to memory of 1884 2016 file.exe 32 PID 2016 wrote to memory of 1884 2016 file.exe 32 PID 2016 wrote to memory of 320 2016 file.exe 35 PID 2016 wrote to memory of 320 2016 file.exe 35 PID 2016 wrote to memory of 320 2016 file.exe 35 PID 2016 wrote to memory of 2028 2016 file.exe 34 PID 2016 wrote to memory of 2028 2016 file.exe 34 PID 2016 wrote to memory of 2028 2016 file.exe 34 PID 2016 wrote to memory of 560 2016 file.exe 33 PID 2016 wrote to memory of 560 2016 file.exe 33 PID 2016 wrote to memory of 560 2016 file.exe 33 PID 2016 wrote to memory of 1292 2016 file.exe 36 PID 2016 wrote to memory of 1292 2016 file.exe 36 PID 2016 wrote to memory of 1292 2016 file.exe 36 PID 2016 wrote to memory of 1720 2016 file.exe 37 PID 2016 wrote to memory of 1720 2016 file.exe 37 PID 2016 wrote to memory of 1720 2016 file.exe 37 PID 2016 wrote to memory of 568 2016 file.exe 38 PID 2016 wrote to memory of 568 2016 file.exe 38 PID 2016 wrote to memory of 568 2016 file.exe 38 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 2016 wrote to memory of 1080 2016 file.exe 39 PID 1080 wrote to memory of 820 1080 SetupUtility.exe 40 PID 1080 wrote to memory of 820 1080 SetupUtility.exe 40 PID 1080 wrote to memory of 820 1080 SetupUtility.exe 40 PID 1080 wrote to memory of 820 1080 SetupUtility.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"2⤵PID:1992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:1160
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:544
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:1884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:2028
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"2⤵PID:320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:1292
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:1720
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1683⤵
- Program crash
PID:820
-
-